Deserialization of untrusted data

A deserialization of untrusted data in Fortinet FortiNAC below 7.2.1, below 9.4.3, below 9.2.8 and all earlier versions of 8.x allows attacker to execute unauthorized code or commands via specifically crafted request on inter-server communication port. Note FortiNAC versions 8.x will not be fixed...

CVE-2023-33299

A deserialization of untrusted data in Fortinet FortiNAC below 7.2.1, below 9.4.3, below 9.2.8 and all earlier versions of 8.x allows attacker to execute unauthorized code or commands via specifically crafted request on inter-server communication port. Note FortiNAC versions 8.x will not be fixed...

Malicious code in angular-mep (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 681355ff3db8d03fa0216e4ff152cb0be7e3cd485423c68fc2d3b33c8feae3a5 The OpenSSF Package Analysis project identified 'angular-mep' @ 1.3.0 npm as malicious. It is considered malicious because: - The package...

Fortinet FortiNAC RCE (FG-IR-23-074)

The version of FortiNAC installed on the remote host is prior to 9.4.3. It is, therefore, affected by a vulnerability as referenced in the FG-IR-23-074 advisory. - A deserialization of untrusted data in Fortinet FortiNAC below 7.2.1, below 9.4.3, below 9.2.8 and all earlier versions of 8.x allows...

Malicious code in grocerylink (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3c167b1a59e67f43b700baa8db7d39f8bb9a6e73f21b40a018e400d0eec5ae2e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in flutter_appsflyer_sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 925db0740f51975e7310d7357f8e32c78cb9d96496fc52915d6eff365500204a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-1339 Malicious code in vymo-jsevaluator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 043529532706257e33267bd81302d8dbf55ac5d275567919f6d62991806ba6e2 The OpenSSF Package Analysis project identified 'vymo-jsevaluator' @ 50.20.0 npm as malicious. It is considered malicious because: - The package...

MAL-2023-1355 Malicious code in barcodeqrgen (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7e27682d3c0d71a71640f7d7830be4cd2125402e0509403333eb45413256f63c The OpenSSF Package Analysis project identified 'barcodeqrgen' @ 1.0.3 pypi as malicious. It is considered malicious because: - The package...

MAL-2023-1345 Malicious code in workfront-rte (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 29da7f471e2f22aa3a14670bb0d11d78a1ee7650004b4316a0a1448b0b185be8 The OpenSSF Package Analysis project identified 'workfront-rte' @ 1.1.1 npm as malicious. It is considered malicious because: - The package...

MAL-2023-1235 Malicious code in mfe-test-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 976982bf72cee0087094ae0b3d8c7b6bfd8e5efd18fb3efa3f192b175f6df360 The OpenSSF Package Analysis project identified 'mfe-test-utils' @ 1.1.1 npm as malicious. It is considered malicious because: - The package...

MAL-2023-1277 Malicious code in quarry-connected (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 9c875d815dcc55750fdec27a84807be3eca1bca0372ca5631501bcc7010b9365 The OpenSSF Package Analysis project identified 'quarry-connected' @ 1.1.1 npm as malicious. It is considered malicious because: - The package...

MAL-2023-1172 Malicious code in ent-memberassistance-helppopup (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 617211f3573ab14bc57da3efe5ce49c8ed667e590c643d1a62fbe680ab531b48 The OpenSSF Package Analysis project identified 'ent-memberassistance-helppopup' @ 1.0.0 npm as malicious. It is considered malicious because: -...

Malicious code in usaa-combobox (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4e892dcf4e3ded1dbf0fcc40f606985a800f80c2d34bc734649a22cec7256fe4 The OpenSSF Package Analysis project identified 'usaa-combobox' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

CVE-2023-31410

A remote unprivileged attacker can intercept the communication via e.g. Man-In-The-Middle, due to the absence of Transport Layer Security TLS in the SICK EventCam App. This lack of encryption in the communication channel can lead to the unauthorized disclosure of sensitive information. The attack...

CVE-2023-31410

The CVE concerns the SICK EventCam App where communications lack TLS, enabling potential Man-In-The-Middle eavesdropping and disclosure of sensitive data. The primary affected component is the EventCam App’s communication channel with clients; root cause is absence of encryption in transit. Publi...

CVE-2023-31410

A remote unprivileged attacker can intercept the communication via e.g. Man-In-The-Middle, due to the absence of Transport Layer Security TLS in the SICK EventCam App. This lack of encryption in the communication channel can lead to the unauthorized disclosure of sensitive information. The attack...

Malicious code in pesa-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 35638e48d3366cc403349a519a4cfc7af6213a9eba4622bbeec1ee3e8ceb3449 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-1423 Malicious code in att-codekit (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 004ba0a87bf93fad7e23fc134ea62c1fad90d2917fff3ad6ca64a87adf16f69d The OpenSSF Package Analysis project identified 'att-codekit' @ 5.1.0 rubygems as malicious. It is considered malicious because: - The package...

CVE-2023-27396

FINS Factory Interface Network Service is a message communication protocol, which is designed to be used in closed FA Factory Automation networks, and is used in FA networks composed of OMRON products. Multiple OMRON products that implement FINS protocol contain following security issues --...

CVE-2023-27396

FINS Factory Interface Network Service is a message communication protocol, which is designed to be used in closed FA Factory Automation networks, and is used in FA networks composed of OMRON products. Multiple OMRON products that implement FINS protocol contain following security issues --...